From 1976e00c537cc5685577b12a407589848a300b42 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 10 Sep 2026 09:55:41 -0600
Subject: [PATCH] update file src/main/java/SqlInjection.java

---
 src/main/java/SqlInjection.java | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/main/java/SqlInjection.java b/src/main/java/SqlInjection.java
index 2b186e2f..0149f206 100644
--- a/src/main/java/SqlInjection.java
+++ b/src/main/java/SqlInjection.java
@@ -1,14 +1,19 @@
 // https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#anatomy-of-a-typical-sql-injection-vulnerability
 
 import java.sql.*;
+import javax.sql.rowset.CachedRowSet;
+import javax.sql.rowset.RowSetProvider;
 import javax.servlet.http.HttpServletRequest;
 
 public class SqlInjection {
     public static ResultSet doQuery(HttpServletRequest request, Connection connection) throws SQLException {
         String customerName = request.getParameter("customerName");
         String query = "SELECT account_balance FROM user_data WHERE user_name = " + customerName;
-        Statement statement = connection.createStatement();
-        ResultSet results = statement.executeQuery(query);
+        CachedRowSet results = RowSetProvider.newFactory().createCachedRowSet();
+        try (Statement statement = connection.createStatement();
+             ResultSet resultSet = statement.executeQuery(query)) {
+            results.populate(resultSet);
+        }
         return(results);
     }
 }